security

PWNED

Cursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS

Welcome back to PWNED, in which The Reg offers cautionary tales from folks who’ve left their doors wide open to attackers and lived to tell the tale. This week’s misadventure involves unpatched older machines and a password that was supposed to send a message to crims.

Our story comes courtesy once again of leading red teamer and pen tester Dahvid Schloss of Suzu Labs .

A client asked Schloss to visit a factory and check the servers there for security holes. The company had been hacked six months prior, made some adjustments, and wanted to make sure that they were bulletproof now.

Schloss' mission, which he chose to accept, was to get domain admin rights.

Schloss drove over to the factory where he noticed a number of Windows 7 servers were connected to the CNC milling machines, even though Windows 10 was by then Microsoft's supported desktop OS.…